VPN site-a-site sur ASA 5506 version 9.8

[Hamza El Boukaoui]

hello,

i have two asa 5506 and i wanted to configure a vpn sas.

i used the wizard and cli but not working, i don't find any thing on the logs.

any help please.

[balaji.bandi · Accepted solution]

First need to check, Are you able to reach ASA to ASA before you process to Site to Site VPN.

post the config of both ASA here.

You can find example and troubleshoot tips :

https://www.petenetlive.com/KB/Article/0001429

[Georg Pauwen]

Hello,

hard to say what is missing, since your probably used the ASDM VPN Wizard. 

The Wizard has a summary screen (.7 in the attached document), can you post a screenshot of that ?

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/119141-configure-asa-00.html

[Georg Pauwen]

Just out of curiosity, how did you resolve this, what was the issue ?

[Hamza El Boukaoui]

the problem don't resolved yet 

[Georg Pauwen]

Hello,

 I would suggest not marking the question as 'resolved' if it is actually not. The reason is that once you do, nobody will look at it anymore because the assumption is that it is.

[Hamza El Boukaoui]

thank you, 

sorry i think i clicked on Accept as Solution with no purpose.

[Georg Pauwen]

Hello,

no big deal. I am not a moderator or anything, it just helps you to mark anything as resolved when it actually is resolved. People usually skip resolved posts, as they assume the problem is...well...resolved.

Either way, did changing the NAT exemption from 'inside_2' to 'inside' change anything ?

[Hamza El Boukaoui]

ok, thank you i appreciate that.

nope nat command didn't change anything  

[Georg Pauwen]

Hello,

I think the NAT exemption statement on your asa1 might be wrong. Change:

nat (inside_2,outside) source static local local destination static remote remote no-proxy-arp route-lookup

to

nat (inside,outside) source static local local destination static remote remote no-proxy-arp route-lookup

so the inside interface reflects the BDI.

[Hamza El Boukaoui]

no sir this didn't work

[Georg Pauwen]

Hello,

are these 5506-X ASAs ? I think the BVI is the default configuration for these devices (starting from 9.7). Do you really need the BVI ?